policy modification openvpn

local_openvpn.te

@@ -10,9 +10,9 @@ require {
 	type xdg_data_t;
 	class file { execute_no_trans getattr open read };
 	class unix_stream_socket connectto;
-	class dir { add_name search };
+	class dir { add_name search remove_name write };
 	class process { getcap setcap };
-	class sock_file create;
+	class sock_file { create write getattr setattr unlink };
 	class lnk_file read;
 }
 
@@ -20,10 +20,12 @@ require {
 allow NetworkManager_t lib_t:file execute_no_trans;
 allow NetworkManager_t openvpn_t:unix_stream_socket connectto;
 allow NetworkManager_t systemd_machined_t:unix_stream_socket connectto;
+allow openvpn_t NetworkManager_runtime_t:dir { write remove_name };
+allow openvpn_t NetworkManager_runtime_t:sock_file { write getattr setattr unlink };
 
 #============= openvpn_t ==============
-allow openvpn_t NetworkManager_runtime_t:dir add_name;
-allow openvpn_t NetworkManager_runtime_t:sock_file create;
+allow openvpn_t NetworkManager_runtime_t:dir { write remove_name add_name };
+allow openvpn_t NetworkManager_runtime_t:sock_file { create write getattr setattr unlink };
 allow openvpn_t lib_t:file execute_no_trans;
 allow openvpn_t self:process { getcap setcap };
 allow openvpn_t selinux_config_t:lnk_file read;